As programmable logic integrated circuits become denser, cheaper and faster, they are increasingly being used in high production volume designs that historically have instead employed gate array or standard cell ASIC. This transition to programmable logic circuitry creates opportunities for design theft which do not occur with ASICs to the same extent. Design theft is of special concern with SRAM-based chips that power up "unconfigured" and must be loaded from a separate configuration memory. The problem with these devices from a security standpoint is that SRAM-based programmable logic circuitry, such as many FPGAs, lose their programmed configuration on power down. Each time a SRAM-based FPGA is powered up, a bit stream is loaded into the device from an external memory source, which is usually a non-volatile memory chip, such as an EPROM or EEPROM, or sometimes a microcontroller. FIG. 1 illustrates a typical unsecured system of the prior art. Programmable logic 11 and configuration memory 13 (or microcontroller) chip packages are both mounted on a printed circuit board 15 with a data connection 17 between them so that configuration data can be loaded into the programmable logic 11 on power up. The external memory device 13 is a unsecured device that is easily removed from the board. Using a commercial programmer, the contents of the memory device 13 can be read and copied. Alternatively, the data line 17 and the memory's external pins 19 form a unsecured link in which the configuration bitstream can be read as the data is transferred into the programmable device 11 by placing a probe on the printed circuit board trace 17 or the device pins 19 and using a logic analyzer to capture the data. Once captured the data can be readily duplicated, allowing theft of whole circuit designs.
Antifuse, EEPROM and flash memory-based devices also aren't immune from reverse-engineering or duplication. If the design is valuable enough, a clever cracker will strive mightily to figure out a way to extract it. High voltage application on external pins to put the part into a test mode, and die probing, are some of the techniques used here.
Because unscrupulous systems manufacturers exist who ignore all valid copyright and patent claims to a circuit design, or are insulated by weak intellectual property laws in some countries, and will not hesitate to copy new circuit designs in the rush to make a quick profit, it is increasingly desirable to find ways to secure the contents of the configuration memory.
Presently, security schemes involve a combination of a security bit in the memory devices and encryption of the serial data stream being transferred to the programmable logic. Such techniques are described in U.S. Pat. Nos. 4,812,675; 4,852,044; 5,349,249; 5,388,157; 5,446,864; 5,640,347; 5,768,372; 5,915,017; and 5,970,142. However, while a security bit is easily implemented, encryption of the data stream adds complexity and cost to both the memory chip and the target programmable device.
An object of the invention is to provide a simpler and less costly way to secure configuration data from dishonest manufacturers.